# Vulnerabilities published in 2023


- [CVE-2023-2706](https://insights.sbomify.com/CVE-2023-2706/): OTP Login Woocommerce & Gravity Forms <= 2.2 - Authentication Bypass to Privilege Escalation (high 8.1)
- [CVE-2023-27059](https://insights.sbomify.com/CVE-2023-27059/): Cross-site scripting in churchcrm:churchcrm (high 7.8)
- [CVE-2023-27055](https://insights.sbomify.com/CVE-2023-27055/): Path traversal in aver:ptzapp 2 (high 7.5)
- [CVE-2023-27054](https://insights.sbomify.com/CVE-2023-27054/): Cross-site scripting in mirotalk:mirotalk p2p (medium 6.1)
- [CVE-2023-27052](https://insights.sbomify.com/CVE-2023-27052/): SQL injection in moosikay project:moosikay (critical 9.8)
- [CVE-2023-2705](https://insights.sbomify.com/CVE-2023-2705/): Appointment booking addon for Gravity Forms < 1.10.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2023-27043](https://insights.sbomify.com/CVE-2023-27043/): Security feature bypass in fedoraproject:fedora (medium 5.3)
- [CVE-2023-27042](https://insights.sbomify.com/CVE-2023-27042/): Memory corruption in tenda:ax3 firmware (high 8.8)
- [CVE-2023-27041](https://insights.sbomify.com/CVE-2023-27041/): SQL injection in school registration and fee system project:school registration and fee system (critical 9.8)
- [CVE-2023-27040](https://insights.sbomify.com/CVE-2023-27040/): Code injection in simple image gallery web app project:simple image gallery web app (critical 9.8)
- [CVE-2023-2704](https://insights.sbomify.com/CVE-2023-2704/): BP Social Connect <= 1.5 - Authentication Bypass (critical 9.8)
- [CVE-2023-27037](https://insights.sbomify.com/CVE-2023-27037/): SQL injection in qibosoft:qibocms (high 8.8)
- [CVE-2023-27035](https://insights.sbomify.com/CVE-2023-27035/): Security feature bypass in obsidian:obsidian (medium 6.5)
- [CVE-2023-27034](https://insights.sbomify.com/CVE-2023-27034/): SQL injection in joommasters:jms blog (critical 9.8)
- [CVE-2023-27033](https://insights.sbomify.com/CVE-2023-27033/): Code injection in cdesigner project:cdesigner (critical 9.8)
- [CVE-2023-27032](https://insights.sbomify.com/CVE-2023-27032/): SQL injection in idnovate:popup module \(on entering\, exit popup\, add product\) and newsletter (critical 9.8)
- [CVE-2023-2703](https://insights.sbomify.com/CVE-2023-2703/): Information Disclosure in Finex Media's Competition Management System (high 7.5)
- [CVE-2023-27025](https://insights.sbomify.com/CVE-2023-27025/): RuoYi vulnerable to arbitrary file download (high 7.5)
- [CVE-2023-27021](https://insights.sbomify.com/CVE-2023-27021/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2023-27020](https://insights.sbomify.com/CVE-2023-27020/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2023-2702](https://insights.sbomify.com/CVE-2023-2702/): IDOR in Finex Media's Competition Management System (high 8.8)
- [CVE-2023-27019](https://insights.sbomify.com/CVE-2023-27019/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2023-27018](https://insights.sbomify.com/CVE-2023-27018/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2023-27017](https://insights.sbomify.com/CVE-2023-27017/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2023-27016](https://insights.sbomify.com/CVE-2023-27016/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2023-27015](https://insights.sbomify.com/CVE-2023-27015/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2023-27014](https://insights.sbomify.com/CVE-2023-27014/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2023-27013](https://insights.sbomify.com/CVE-2023-27013/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2023-27012](https://insights.sbomify.com/CVE-2023-27012/): Memory corruption in tenda:ac10 firmware (critical 9.8)
- [CVE-2023-27010](https://insights.sbomify.com/CVE-2023-27010/): Privilege escalation in wondershare:dr.fone (high 7.8)
- [CVE-2023-2701](https://insights.sbomify.com/CVE-2023-2701/): Gravity Forms < 2.7.5 - Reflected XSS (medium 6.1)
- [CVE-2023-27008](https://insights.sbomify.com/CVE-2023-27008/): Cross-site scripting in atutor:atutor (medium 6.1)
- [CVE-2023-27001](https://insights.sbomify.com/CVE-2023-27001/): Auth bypass in egerie:egerie (high 8.8)
- [CVE-2023-27000](https://insights.sbomify.com/CVE-2023-27000/): Cross-site scripting in netscout:ngeniusone (medium 6.1)
- [CVE-2023-2700](https://insights.sbomify.com/CVE-2023-2700/): Denial of service in libvirt (medium 5.5)
- [CVE-2023-26999](https://insights.sbomify.com/CVE-2023-26999/): XML external entity in netscout:ngeniusone (critical 9.8)
- [CVE-2023-26998](https://insights.sbomify.com/CVE-2023-26998/): Cross-site scripting in netscout:ngeniusone (medium 5.4)
- [CVE-2023-26991](https://insights.sbomify.com/CVE-2023-26991/): Use after free in swftools:swftools (high 7.8)
- [CVE-2023-2699](https://insights.sbomify.com/CVE-2023-2699/): SourceCodester Lost and Found Information System GET Parameter sql injection (medium 6.3)
- [CVE-2023-26987](https://insights.sbomify.com/CVE-2023-26987/): Missing authorization in konga project:konga (medium 6.5)
- [CVE-2023-26986](https://insights.sbomify.com/CVE-2023-26986/): Command injection in chinamobileltd:oa mailbox pc (high 7.8)
- [CVE-2023-26984](https://insights.sbomify.com/CVE-2023-26984/): Missing authorization in peppermint:peppermint (high 8.1)
- [CVE-2023-26982](https://insights.sbomify.com/CVE-2023-26982/): Cross-site scripting in trudesk project:trudesk (medium 5.4)
- [CVE-2023-26980](https://insights.sbomify.com/CVE-2023-26980/): Race condition in pax:paydroid (high 7.0)
- [CVE-2023-2698](https://insights.sbomify.com/CVE-2023-2698/): SourceCodester Lost and Found Information System GET Parameter sql injection (medium 6.3)
- [CVE-2023-26979](https://insights.sbomify.com/CVE-2023-26979/): Security feature bypass in bluetens:bluetensq (low 3.1)
- [CVE-2023-26978](https://insights.sbomify.com/CVE-2023-26978/): Command injection in totolink:a7100ru firmware (critical 9.8)
- [CVE-2023-26976](https://insights.sbomify.com/CVE-2023-26976/): Memory corruption in tenda:ac6 firmware (high 7.5)
- [CVE-2023-26974](https://insights.sbomify.com/CVE-2023-26974/): Memory corruption in irfanview:irfanview (medium 5.5)
- [CVE-2023-2697](https://insights.sbomify.com/CVE-2023-2697/): SourceCodester Online Exam System POST Parameter data sql injection (medium 6.3)
- [CVE-2023-26969](https://insights.sbomify.com/CVE-2023-26969/): Path traversal in atrocore:atropim (high 7.5)
- [CVE-2023-26968](https://insights.sbomify.com/CVE-2023-26968/): File upload in atrocore:atrocore (critical 9.8)
- [CVE-2023-26966](https://insights.sbomify.com/CVE-2023-26966/): Memory corruption in libtiff:libtiff (medium 5.5)
- [CVE-2023-26965](https://insights.sbomify.com/CVE-2023-26965/): Use after free in libtiff:libtiff (medium 5.5)
- [CVE-2023-26964](https://insights.sbomify.com/CVE-2023-26964/): h2 vulnerable to denial of service (high 7.5)
- [CVE-2023-26961](https://insights.sbomify.com/CVE-2023-26961/): File upload in alteryx:alteryx server (medium 4.8)
- [CVE-2023-2696](https://insights.sbomify.com/CVE-2023-2696/): SourceCodester Online Exam System POST Parameter data sql injection (medium 6.3)
- [CVE-2023-26959](https://insights.sbomify.com/CVE-2023-26959/): SQL injection in phpgurukul:park ticketing management system (critical 9.8)
- [CVE-2023-26958](https://insights.sbomify.com/CVE-2023-26958/): Cross-site scripting in phpgurukul:park ticketing management system (medium 4.8)
- [CVE-2023-26957](https://insights.sbomify.com/CVE-2023-26957/): Missing authorization in onekeyadmin:onekeyadmin (critical 9.1)
- [CVE-2023-26956](https://insights.sbomify.com/CVE-2023-26956/): Path traversal in onekeyadmin:onekeyadmin (high 7.5)
- [CVE-2023-26955](https://insights.sbomify.com/CVE-2023-26955/): Cross-site scripting in onekeyadmin project:onekeyadmin (medium 5.4)
- [CVE-2023-26954](https://insights.sbomify.com/CVE-2023-26954/): Cross-site scripting in onekeyadmin project:onekeyadmin (medium 5.4)
- [CVE-2023-26953](https://insights.sbomify.com/CVE-2023-26953/): Cross-site scripting in onekeyadmin:onekeyadmin (medium 4.8)
- [CVE-2023-26952](https://insights.sbomify.com/CVE-2023-26952/): Cross-site scripting in onekeyadmin:onekeyadmin (medium 5.4)
- [CVE-2023-26951](https://insights.sbomify.com/CVE-2023-26951/): Cross-site scripting in onekeyadmin:onekeyadmin (medium 5.4)
- [CVE-2023-26950](https://insights.sbomify.com/CVE-2023-26950/): Cross-site scripting in onekeyadmin:onekeyadmin (medium 5.4)
- [CVE-2023-2695](https://insights.sbomify.com/CVE-2023-2695/): SourceCodester Online Exam System POST Parameter data sql injection (medium 6.3)
- [CVE-2023-26949](https://insights.sbomify.com/CVE-2023-26949/): File upload in onekeyadmin:onekeyadmin (critical 9.8)
- [CVE-2023-26948](https://insights.sbomify.com/CVE-2023-26948/): Path traversal in onekeyadmin:onekeyadmin (high 7.5)
- [CVE-2023-26943](https://insights.sbomify.com/CVE-2023-26943/): Weak cryptography in assaabloy:yale keyless smart lock firmware (medium 6.5)
- [CVE-2023-26942](https://insights.sbomify.com/CVE-2023-26942/): Weak cryptography in assaabloy:yale ia-210 firmware (medium 6.5)
- [CVE-2023-26941](https://insights.sbomify.com/CVE-2023-26941/): Weak cryptography in assaabloy:yale conexis l1 firmware (medium 6.5)
- [CVE-2023-2694](https://insights.sbomify.com/CVE-2023-2694/): SourceCodester Online Exam System POST Parameter data sql injection (medium 6.3)
- [CVE-2023-26930](https://insights.sbomify.com/CVE-2023-26930/): Memory corruption in xpdfreader:xpdf (medium 5.5)
- [CVE-2023-2693](https://insights.sbomify.com/CVE-2023-2693/): SourceCodester Online Exam System POST Parameter data sql injection (medium 6.3)
- [CVE-2023-26925](https://insights.sbomify.com/CVE-2023-26925/): Information disclosure in dlink:dir-882 firmware (high 7.5)
- [CVE-2023-26924](https://insights.sbomify.com/CVE-2023-26924/): Memory corruption in llvm:llvm (medium 5.5)
- [CVE-2023-26923](https://insights.sbomify.com/CVE-2023-26923/): Memory corruption in musescore:musescore (high 7.0)
- [CVE-2023-26922](https://insights.sbomify.com/CVE-2023-26922/): SQL injection in variscite:matrix-gui (critical 9.8)
- [CVE-2023-26921](https://insights.sbomify.com/CVE-2023-26921/): Command injection in quectel:ag550qcn firmware (critical 9.8)
- [CVE-2023-26920](https://insights.sbomify.com/CVE-2023-26920/): Code injection in naturalintelligence:fast xml parser (medium 6.5)
- [CVE-2023-2692](https://insights.sbomify.com/CVE-2023-2692/): SourceCodester ICT Laboratory Management System GET Parameter room_info.php cross site scripting (low 3.5)
- [CVE-2023-26919](https://insights.sbomify.com/CVE-2023-26919/): Security feature bypass in javadelight:nashorn sandbox (high 7.2)
- [CVE-2023-26918](https://insights.sbomify.com/CVE-2023-26918/): Misconfiguration in filereplicationpro:file replication pro (critical 9.8)
- [CVE-2023-26917](https://insights.sbomify.com/CVE-2023-26917/): Null dereference in cesnet:libyang (high 7.5)
- [CVE-2023-26916](https://insights.sbomify.com/CVE-2023-26916/): Null dereference in cesnet:libyang (medium 5.3)
- [CVE-2023-26913](https://insights.sbomify.com/CVE-2023-26913/): Cross-site scripting in evolucare:ecs imaging (medium 6.1)
- [CVE-2023-26912](https://insights.sbomify.com/CVE-2023-26912/): Cross-site scripting in s-mall-ssm project:s-mall-ssm (medium 4.8)
- [CVE-2023-26911](https://insights.sbomify.com/CVE-2023-26911/): Privilege escalation in asus:armoury crate (high 7.8)
- [CVE-2023-2691](https://insights.sbomify.com/CVE-2023-2691/): SourceCodester Personnel Property Equipment System POST Parameter add_item.php cross site scripting (low 3.5)
- [CVE-2023-26905](https://insights.sbomify.com/CVE-2023-26905/): SQL injection in alphaware - simple e-commerce system project:alphaware - simple e-commerce system (critical 9.8)
- [CVE-2023-2690](https://insights.sbomify.com/CVE-2023-2690/): SourceCodester Personnel Property Equipment System GET Parameter returned_reuse_form.php sql injection (medium 6.3)
- [CVE-2023-2689](https://insights.sbomify.com/CVE-2023-2689/): SourceCodester Billing Management System GET Parameter editproduct.php sql injection (medium 6.3)
- [CVE-2023-2688](https://insights.sbomify.com/CVE-2023-2688/): WordPress File Upload / WordPress File Upload Pro <= 4.19.1 - Authenticated (Administrator+) Path Traversal (medium 4.9)
- [CVE-2023-26877](https://insights.sbomify.com/CVE-2023-26877/): File upload vulnerability found in Softexpert Excellence Suite v.2.1 allows attackers to execute arbitrary code via a .php file upload to th (medium 6.3)
- [CVE-2023-26876](https://insights.sbomify.com/CVE-2023-26876/): SQL injection in piwigo:piwigo (high 8.8)
- [CVE-2023-2687](https://insights.sbomify.com/CVE-2023-2687/): Memory corruption in Gecko SDK (low 2.9)
- [CVE-2023-26866](https://insights.sbomify.com/CVE-2023-26866/): Command injection in greenpacket:ot-235 firmware (critical 9.8)
- [CVE-2023-26865](https://insights.sbomify.com/CVE-2023-26865/): SQL injection in brandsdistribution:bdroppy (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/353/